malwarewikiaorg-20200223-history
Arriba
Virus.DOS.Arriba is a memory resident parasitic virus on DOS. There are 2 variants: *Virus.DOS.Arriba.1590 (A and B) Payload When the virus is loaded into memory, it hooks INT 21h and 24h to infect any executable that is run. The virus behaves stealthy when MEM is run so that the actual memory comsumption of the virus will not be shown, but the size change of the infected files is still visible. Advanced details The TSR memory usage of the variants: MD5 hashes: Arriba.1590.a This variant activates on November 20. It displays a marquee in high speed, followed by hanging the system: Cara al sol con la camisa nueva que tu bordaste rojo ayer hallaras la muerte si te llega y no te vuelvo a ver formare junto a mis compañeros que hacen guardia sobre los luceros impasible el ademan y están presentes en nuestro afan si te dicen que cai me fui al puesto que tengo alli volveran banderas victoriosas al paso alegre de la paz y seran prendidas cinco rosas las flechas de mi paz volvera a reir la primavera que por cielo y tierra y mar esperan arriba a España y a vencer, que en España empieza a AMANECER 20-N-90 Spain Jaws & Shark ARRIBA ESPAÑA Translation (from Spanish): Face to the sun with the new shirt the userr red embroider on yesterday the user will find death if it comes to the user And I never see the user again I will train with my partners Who stand guard over the stars Impassible motion and are present In our eagerness If they tell the user to fall I went to the post I have there Will return victorious flags to the merry step Of peace and five roses will be caught the arrows of my peace Spring will laugh again than by sky and land and sea They wait up to Spain and to overcome, that in Spain begins Arriba.1590.b This variant activates on May 19, it would also display a marquee but failed: Tres Anillos para los Reyes Elfos bajo el cielo. Siete para los Señores Enanos en palacios de piedra. Nueve para los Hombres Mortales condenados a morir. Uno para el Señor Oscuro sobre el trono oscuro en la Tierra de Mordor donde se extienden las Sombras. Un Anillo para gobernarlos a todos. Un Anillo para encontrarlos, un Anillo para atraerlos a todos y atarlos en las tinieblas en la Tierra de Mordor donde se extienden las Sombras. Extracto de "El Señor de los Anillos" de J.R.R. TOLKIEN. 1955 Virus Tolkien vK&S. © IMV, STi, K&S 1995. Created in Chiba City. The Spock's Mutation Factory are the fast in the world. We are professionals. Thanks to Central Point for their PC Tools Deluxe R4.20. Use the userr Debugger. Translation (from Spanish): Three Rings for the Elven Kings under the sky. Seven for the Dwarf Lords in stone palaces. Nine for the mortal men doomed to die. One for the Dark Lord on the dark throne in the Land of Mordor where the Shadows extend. One Ring to rule them all. A Ring to find them, a Ring to lure them all and tie them in the darkness in the Land of Mordor where the Shadows extend. Extract from "The Lord of the Rings" by J.R.R. TOLKIEN. 1955 The rest are in English Other details According to the text strings in Arriba.1590.b, debugging is required in order to activate the payload. Media zh:Arriba Category:DOS virus Category:DOS Category:Virus Category:TSR Category:Assembly